Passkeys are not a panacea. They're an amalgam of multiple standards that half the time aren't implemented right or not fully supported. It's the industry's attempt to design-by-committee a one-size-fits all solution to many, many different problems. News flash: one-size-fits-all fits nobody well.<p>Passwords are a perfectly fine single factor. Add more factors to get more security, in specific use cases where they make sense. Passkeys don't fill the use case that a single-factor like passwords do.<p>Password Managers are also perfectly fine when combined with multiple factors and attack mitigations (and are certainly no worse than Passkeys we have now, key access managed by a central piece of software/key control/authorization). They solve many different use cases without breaking others. They're customizable, and not overly-dependent on standards. They are a loosely-coupled interface. They can be synchronized for multiple device/site access. They can be upgraded to support an infinite amount of security mechanisms. They can be changed in backwards-compatible ways, and they don't force one-size-fits-all on anybody. They even support Passkeys without forcing you to use them (though of course lots of Passkey software ignores the fact that you might have a password manager, and forces you to use the browser's Passkey store or nothing).<p>You want to uniquely identify a device? Fingerprint it on login. Having a separate passkey per device isn't any better, because if the attacker can get the device fingerprint, they can also probably get the passkey, because they have access to the device. And password reset still has to be a thing, because we all lose devices, backup codes, etc, so it's not like there isn't an easier attack anyway.<p>How is the passkey that much better than client-side certificates from 15 years ago? That was abandoned because of all the problems around key management; and now you want to bring back key management?!<p>Please stop trying to solve a problem by creating more problems. This is all about use cases. Just let users, and companies, decide what use cases they'll support. Don't force everyone to use a crap solution just because it makes big corporations happy.